<?php
include '../includes/db.php';

if (!isset($_GET['id']) || !isset($_GET['status'])) {
    header("Location: appointment.php");
    exit;
}

$id = (int) $_GET['id'];
$status = $_GET['status'];

// Allow only valid statuses
$allowed = ['Approved', 'Cancelled'];
if (!in_array($status, $allowed)) {
    header("Location: appointment.php");
    exit;
}

$stmt = $conn->prepare("UPDATE appointments SET status=? WHERE id=?");
$stmt->bind_param("si", $status, $id);
$stmt->execute();

// 🔴 IMPORTANT: redirect back to list
header("Location: appointment.php?msg=updated");
exit;
